Plans to share your NHS data OUTSIDE the health service on hold as thousands riot

More than a million patients have opted out of sharing NHS data in one month – a huge backlash against plans to consolidate personal records from GP practices across England into a centralized database accessible to researchers and commercial companies outside the health service. Privacy activists have expressed serious concerns about NHS Digital’s plans to import the medical histories of more than 55 million patients in England into a new database, including data on mental and sexual health, criminal records and more sensitive information.

Following the protest, NHS Digital has moved the opt-out deadline from June 23 to September 1, 2021 to give those affected more time to remove their health records from the database. However, figures published exclusively by The Observer have now revealed the sheer number of people who have decided to opt out before the deadline.

With over a million people voicing their displeasure with the plan, it’s not surprising that the data grab is now under threat. NHS Digital has made some concessions to privacy activists to try and salvage the plan, dubbed the General Practice Data for Planning and Research.

NHS Digital has dropped its September 1, 2021, but no new launch date has been announced. For those who were concerned about the data grab, but haven’t had a chance to fill out the paperwork and send it to their GP practice yet…this is very good news. There is no chance that your medical records will be transferred to a central database in the short term.

To allay the fears, NHS Digital will begin a so-called “listening exercise” before launching a public information campaign to raise awareness of the plans ahead of the new deadline… whenever that will be.

Even before the consultation process begins, NHS Digital has made a huge concession to campaigners: patients can request the deletion of their data at any time. Health records that have already been added to the database can be deleted at a later time, for example if you missed the original deadline.

Previously, NHS Digital had warned anyone who opted out after the deadline that future health data would be removed from the database. However, all historical data would still remain available to researchers, academic and commercial partners of the NHS.

NHS Digital has also committed to improving the security and privacy of the data stored.

The centralized database will contain a number of sensitive health categories, including mental and sexual health data, criminal records, full zip code and date of birth. Earlier this year, NHS Digital confirmed that anything that could be used to identify you from your GP records would be pseudonymized before being uploaded. However, the code to decipher the anonymized data is kept by the NHS.

This has set off alarm bells for some privacy activists, as it’s a very different approach to the biggest tech companies, including Apple and WhatsApp, which don’t store the digital keys that can decrypt the anonymized data. That’s why Apple refused to help FBI investigators who hoped to unlock an iPhone owned by one of the terrorist suspects.

According to Apple CEO Tim Cook, “In today’s digital world, the ‘key’ to an encrypted system is a piece of information that unlocks the data, and it’s only as secure as the protections around it. Once the information is known, or a way to bypass the code is revealed, the encryption can be destroyed by anyone with that knowledge.In the physical world it would be the equivalent of a master key, which can open hundreds of millions of locks – from restaurants and banks to shops and homes. No reasonable person would find that acceptable.”

NHS Digital will have the keys to unlocking its anonymized data, but says it “will only ever re-identify the data if there was a lawful reason to do so and it would have to comply with data protection legislation”. In an example scenario of why medical records would be decrypted to reveal the patient’s identity, NHS Digital adds: “a patient may have consented to participate in a research project or clinical trial and have already given consent for their data shared with the researchers for this purpose.”